US Bankruptcy Data Sales: Section 363(b)(1), the Consumer Privacy Ombudsman and the FTC Conditions

A US bankruptcy estate may sell its data, including to AI buyers, but a sale outside the ordinary course needs notice and a hearing under 11 U.S.C. 363(b)(1), and personally identifiable information covered by the debtor's privacy policy may move only on one of two routes. The first route is a sale consistent with that policy; the second is court approval after a consumer privacy ombudsman's review under 11 U.S.C. 332.

The Spirit Airlines chapter 11 is the dated example of a court-supervised route in AI training data licensing: Google LLC is the successful bidder at USD 10,000,000 for de-identified business data, and the sale is not approved as of 2026-11-09, with the sale hearing set for 2026-11-17. DataPacts is not a broker and takes no cut of any sale.

The statutes, rules, dockets and figures below were checked against their primary sources, under the rules on how we source, date and check every figure.

What Section 363 Lets a Chapter 7 Trustee or Chapter 11 Debtor Sell

Section 363(b)(1) lets the trustee, in chapter 11 usually the debtor in possession, sell estate property outside the ordinary course of business after notice and a hearing, and a data archive sold to an AI buyer is such a sale. The court must approve it, so a bid or an auction result is not yet a sale. In Spirit, the bidding procedures order of 2026-06-22 (ECF No. 1213) set the process.

Section 363(f) lets the sale pass free and clear of interests if one of five conditions is met. This page uses "trustee" as section 363 does.

The Privacy-Policy Proviso: Two Routes to Selling Personally Identifiable Information

If the debtor's privacy policy in effect at the filing restricts transfers, the estate may sell personally identifiable information only if the sale is consistent with that policy, or if the court approves it after a consumer privacy ombudsman's review. Pub. L. 109-8 (2005) added the proviso. Route (B) requires an ombudsman, notice and a hearing, and a court that gives due consideration to the facts, circumstances and conditions and finds no showing that the sale would violate applicable nonbankruptcy law.

The table compares the two routes as of 2026-11-09. "Personally identifiable information" is defined in 11 U.S.C. 101(41A).

The definition in 11 U.S.C. 101(41A) covers data an individual provided to obtain products or services primarily for personal, family or household purposes, so employee and business-to-business records fall outside the proviso on its face. State standards can still be used: in Spirit the debtors adopted the de-identification standard of Cal. Civ. Code 1798.140(m) by letter of 2026-08-05. The gap for staff records is the subject of employee data in bankruptcy data sales.

The Consumer Privacy Ombudsman: Appointment, Report and Limits

The consumer privacy ombudsman is the person the U.S. trustee appoints under 11 U.S.C. 332, not later than 7 days before the sale hearing, when the estate takes route (B). The deadline was 5 days until 2009-12-01 (Pub. L. 111-16). Under Fed. R. Bankr. P. 6004(g), restyled on 2024-12-01, the sale motion must request the appointment, and the U.S. trustee gives notice of it at least 7 days before the hearing.

Section 332(c) bars the ombudsman from disclosing personally identifiable information obtained in the role. The report informs the decision, and the court decides.

The limits are visible in the record. The definition in section 101(41A) is consumer-only. In Spirit, the supplemental report states in its footnote 3 that risks to employees and third parties were not investigated. No ombudsman appears in the Character.AI record.

The FTC Conditions From Toysmart and What an AI Buyer Inherits

The FTC conditions are the four limits the FTC's settlement with Toysmart.com placed on selling customer data in bankruptcy, which the FTC restated in its 2015 letter in the RadioShack case. FTC v. Toysmart.com, LLC (D. Mass. 00-11341-RGS) was filed in July 2000. In In re RadioShack Corporation (Bankr. D. Del. 15-10197 (BLS)), the FTC's Bureau of Consumer Protection wrote on 2015-05-16 about a sale of customer information under a privacy policy that promised not to sell it.

The table lists the conditions as the FTC summarized them in that letter, as of 2026-11-09.

These conditions are the FTC's position, not a section of the Code. A buyer outside the debtor's line of business is the case they were written for, so an AI buyer that is not in substantially the same line of business would meet the second condition head on; that reading is an inference from the conditions, not an FTC ruling on AI buyers.

The FTC Act s.5 (15 U.S.C. 45) adds a second layer. FTC staff wrote on 2024-02-13 that a surreptitious, retroactive change of terms or privacy policy to permit AI training may be unfair or deceptive, and on 2024-01-09 that the FTC has required firms that unlawfully obtained data to delete models and algorithms, as in the Everalbum settlement of 2021-05-07. The wider topic is covered under FTC rules on AI training data.

How Section 363 Has Applied in Three Chapter 11 Data Cases

Three chapter 11 cases show the three outcomes a data sale can reach: a de-identified archive awaiting approval, a genetic database sold under a court order, and a bid that excludes training data. The table lists them alphabetically as of 2026-11-09.

Spirit Airlines: De-identified Business Data Under Ombudsman Review

In the Spirit Airlines chapter 11 (Bankr. S.D.N.Y. 25-11897 (SHL)), the estate offers de-identified internal business data, and the 2026-08-14 auction produced a successful bid by Google LLC of USD 10,000,000 and an alternate bid by Mercor.io Corporation of USD 7,500,000 (Dkt. 1463), with no court approval as of 2026-11-09. The asset schedule lists 100,000,000 emails, 500,000,000 Teams items and 175,658 employee records as included, and 97,500,000 passenger profiles as "Not Included"; consumer transaction, PNR, refund, inflight and Wi-Fi systems are excluded.

A Deidentification Agent (Tonic.ai) de-identifies the data to Cal. Civ. Code 1798.140(m), plus 45 CFR 164.514 for health data, at the buyer's cost. The ombudsman's reports (Doc. 1581, 2026-09-08; Dkt. 1684, 2026-10-05) find that approval of the sale of the de-identified data "would be appropriate" from a privacy perspective, while footnote 3 leaves employee risks uninvestigated, and the ombudsman asked for further research on Mercor's security incident. The full record is under Spirit Airlines' data archive sale.

micro1 Inc. filed a notice of intent to submit a competing bid (ECF 1556), with no amount in any filing read. Unions and pilots' associations object. The 2026-11-06 hearing was cancelled (Dkt. 1786) and the sale hearing is set for 2026-11-17 (Dkt. 1779), so the successful bid is not an approved sale as of 2026-11-09.

23andMe: A Genetic Database Sold Under a Court Sale Order

23andMe's chapter 11 estate (Bankr. E.D. Mo. 25-40976, filed 2025-03-23) sold substantially all its assets, including its genetic database, to TTAM Research Institute, a California nonprofit public benefit corporation, for USD 305.0 million in cash. Regeneron's USD 256.0 million initial winning bid of 2025-05-17 was superseded; the asset purchase agreement is dated 2025-06-13, the sale order 2025-06-27 and the closing 2025-07-14.

The UK Information Commissioner's Office co-signed a joint letter on the bankruptcy (2025-04-28). The buyer is a nonprofit and the sale is a bankruptcy asset sale, not an AI training license.

Character.AI: A Bidding Process That Leaves Training Data Out

Character Technologies, Inc., the company behind Character.AI, filed chapter 11 on 2026-10-12 (Bankr. D. Del. 26-11603 (BLS)), and its proposed stalking-horse buyer, Disney Worldwide Services, Inc., bids USD 20,000,000 (Doc 15, 2026-10-13) for assets that exclude end-user data, training data and finished models. The debtor's motion caps the break-up fee and expense reimbursement at USD 700,000.

The dates in the motion are proposed: a bid deadline of 2026-11-20, an auction on 2026-11-23 and a sale hearing on 2026-11-24. The record does not show an ombudsman. The case is covered under Character.AI chapter 11.

Selling Estate Data Under Section 363 or Not: Benefits, Risks, Downsides and Alternatives

For a trustee or debtor in possession, a court-approved data sale can raise money for creditors, but the privacy routes, objections and buyer checks add cost and delay, and leaving the data unsold is a valid outcome.

Benefits

• Proceeds from an asset priced by competing bids.
• A sale order passes the property free and clear of interests and documents the decision.
• The ombudsman's report gives the court a privacy record before it rules.

Risks

• Refusal, delay or adjournment of the hearing, as the Spirit schedule shows.
• Data outside section 101(41A), such as employee records, draws objections that the ombudsman does not review.
• A buyer that uses the data against the original privacy promises risks FTC action.

Downsides

• De-identification and ombudsman work cost money and time; the estate's total cost is not in the record.
• Seller representations may not survive closing.
• Retention duties stay with the estate.

Alternatives

1. Not selling: keep the records for their retention periods, then delete them.
2. Selling the business without the data, as in Character.AI.
3. Selling only what route (A) allows, or only de-identified data, as in Spirit.
4. Out of court: assignment for the benefit of creditors and data assets, such as Delaware's 10 Del. C. ch. 73A, which has no ombudsman mechanism.
5. A non-exclusive license on revenue share, as Turing states for Project Lazarus (checked 2026-11-09).

DataPacts takes no position on whether an estate should sell; the decision belongs to the trustee, the creditors and the court.

From Sale Motion to Sale Order: The Steps of a Section 363 Data Sale

A section 363 data sale moves from an inventory of the data and the privacy policy to a sale motion, a bidding process, a privacy review and a hearing, and only the sale order lets the data move.

1. Inventory the data and the privacy policy in effect at the filing.
2. Choose route (A) or route (B).
3. File the sale motion, requesting an ombudsman where route (B) applies.
4. Define excluded systems and an independent de-identification agent and standard, using the rules on PII removal and de-identification.
5. Obtain a bidding procedures order and run the auction, with successful and alternate bidders.
6. Receive the ombudsman's report, objections and replies.
7. Hold the sale hearing, obtain the sale order, then close.

A successful bid is an auction result, not a sale. Payroll and time records keep their federal minimum periods after a sale: 29 CFR 516.5 sets at least 3 years and 29 CFR 516.6 at least 2 years.

Where US Estate Data Sales Connect to the Seller Path and Other Jurisdictions

This page covers the US bankruptcy gate; the pages below cover other jurisdictions, the seller process and the buyers.

• Parent: data assets in insolvency in every jurisdiction
• Outside bankruptcy: selling data from a shut-down or defunct company
• The general decision: should you sell or license your data
• Buyers: who buys AI training data
• Referral limits: referral programs of AI data buyers
• Estate sales among AI data licensing deals
• Law: AI training data law by jurisdiction
• Tracker: bankruptcy estates selling data assets
• Federal and state: US AI training data law
• State rules: California CCPA/CPRA rules
• Health data: HIPAA and AI training data

This page is information, not legal advice.

Frequently Asked Questions

What is a 363 sale, and how does it differ from a chapter 11 plan?

A 363 sale is a sale of estate property outside the ordinary course of business after notice and a hearing under 11 U.S.C. 363(b)(1). It happens during the case and under court approval; section 363(f) allows a sale free and clear of interests if one of five conditions is met.

Can a chapter 7 trustee sell customer data?

Yes, if the sale is consistent with the privacy policy in effect at the filing, or the court approves it after an ombudsman's review. Both routes come from 11 U.S.C. 363(b)(1); the ombudsman is appointed under section 332.

Was 23andMe's data sold?

Yes: a bankruptcy court order of 2025-06-27 approved the sale of 23andMe's assets, including its genetic database, to TTAM Research Institute for USD 305.0 million, and the sale closed on 2025-07-14.